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Abstract 



We study a quantum analogue of locally decodable error-correcting codes. A g-query locally 
decodable quantum code encodes n classical bits in an m-qubit state, in such a way that each of 
the encoded bits can be recovered with high probability by a measurement on at most q qubits 
of the quantum code, even if a constant fraction of its qubits have been corrupted adversarially. 
We show that such a quantum code can be transformed into a classical g-query locally decod- 
able code of the same length that can be decoded well on average (albeit with smaller success 
probability and noise-tolerance). This shows, roughly speaking, that g-query quantum codes 
are not significantly better than q-query classical codes, at least for constant or small q. 

1 Introduction 

1.1 Setting 

Locally decodable codes (LDCs) have received much attention in the last decade. They are error- 
correcting codes that encode n bits into m bits, with the usual error-correcting properties, and the 
additional feature that any one of the n encoded bits can be recovered (with high probability) by a 
randomized decoder that queries at most q bits in the codeword, for some small q. In other words, 
to decode small parts of the encoded data, we only need to look at a small part of the codeword 
instead of "unpacking" the whole thing. Precise definitions will be given in the next sections. 
Such codes are potentially useful in their own right (think of decoding small pieces from a large 
encoded library), and also have a variety of applications in complexity theory and cryptography. 
For instance, it is well known that they can be turned into private information retrieval schemes 
and vice versa (see the appendix). For further details about such connections, we refer to Trevisan's 
survey [Tre04| and the references therein. 

The most interesting question about LDCs is the tradeoff between their length m and the 
number of queries q. The former measures the space efficiency of the code, while the latter measures 
the efficiency of decoding. The larger we make q, the smaller we can make m. On one extreme, if 
we allow q = polylog(n) queries, the codelength m can be made polynomial in n [BFLS91J. On the 
other extreme, for q = 1 and sufficiently large n, LDCs do not exist at all [KTOO] . For q = 2 they 
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do exist but need exponential length, m = 2 e> (") [KW04| . Between these two extremes, interesting 
but hard questions persist. In particular, we know little about the length of LDCs with constant 
q > 2. The best upper bounds for q = 3 are Yekhanin's recent construction [Yek07]: he gives 3- 
query LDCs with length m = 2°( nl/t ) for every Mersenne prime p = 2 — 1. Currently only finitely 
many Mersenne primes are known (the largest has t = 32582657), but it has been conjectured that 
there are infinitely many. For q > 3, shorter codes may be derived by combining Yekhanin's codes 
with the recursive constructions of Beimel et al. [BIKR02]. However, all these bounds still have 
super polynomial length m for every constant q. On the lower bound side, the best we know for 
q > 2 is m = n ((n/logn) 1+1 /(r?/2l-i)) [KT001 IKWM IWoo06j (these bounds are stated for fixed 
success probability and noise rate). For instance for q = 3 and q = 4, our best lower bounds are 
slightly less than n 2 . 

Interestingly, the best known lower bounds were obtained using tools from quantum information 
theory. It is thus a natural question to consider also the potential positive effects of quantum: can 
we construct much shorter g-query locally decodable codes by somehow harnessing the power of 
quantum states and quantum algorithms? There are two natural ways to generalize classical locally 
decodable codes to the quantum world: 

• We can keep the code classical, but allow q quantum queries. This means we can query 
positions of the codeword in quantum superposition, and process the results using quantum 
circuits. This approach was investigated in [KW04]. A g-query quantum decoder can simulate 
a 2g-query classical decoder with high success probability, and this simulation can be made 
exact if the classical decoder took the parity of its 2q bits. This implies for instance that 
Yekhanin's 3-query LDC can be decoded by only 2 quantum queries. In contrast, we know 
that every 2-query LDC needs length 2®( n \ Allowing quantum queries thus results in very 
large savings in m when we consider a fixed number of queries q. 

• We can also make the code itself quantum: instead of encoding an n-bit x into an m-bit 
string C(x), we could encode it into an m-qubit state Q{x). A q-query decoder for such a 
code would select up to q qubits of the state Q(x), and make some 2-outcome measurement 
on those qubits to determine its output. In this case our notion of noise also needs to be 
generalized: instead of up to 5m bitflip-errors, we now allow any set of up to 5m qubits of 
the m-qubit state Q(x) to be arbitrarily changedQ 

1.2 Our results 

In this paper we investigate the second kind of code, which we call a "g-query locally decodable 
quantum code", or g-query LDQC. The question is whether the ability to encode our n bits into a 

1 While a classical LDC can be reused as often as we want, a quantum code has the problem that a measurement 
made to predict one bit changes the state, so predicting another bit based on the changed state may give the wrong 
results. However, if the error probability is small then the changes incurred by each measurement will be small as 
well, and we can reuse the code many times with reasonable confidence. 

Another issue is that more general decoders could be allowed. For instance, we could consider allowing any 
quantum measurement on the m-qubit state that can be written as a linear combination of m-qubit Pauli-matrices 
that have support on at most q positions. This is potentially stronger than what we do now (it is an interesting 
open question whether it is really stronger). However, we feel this is a somewhat unnatural formalization of the idea 
that a measurement should be localized to at most q qubits. Our current set-up, where we classically select up to q 
positions and then apply an arbitrary quantum measurement to those q qubits, seems more natural. 
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quantum state enables us to make codes much shorter. There are some small examples where quan- 
tum encodings achieve things that are impossible for classical encodings. For example, Ambainis 
et al. [ANTV02] give an example of an encoding of 2 classical bits into 1 qubit, such that each of 
the bits — though not both simultaneously — can be recovered from the qubit with success probabil- 
ity 0.85. They even cite an example due to Chuang where 3 bits are encoded into 1 qubit, and each 
bit can be recovered with success probability 0.78. However, they also show that asymptotically 
large savings are not possible in their setting of random access codes (explained in Section 13.41 
below) . 

Their setting, however, considers neither noise nor local decodability, and hence does not answer 
our question about locally decodable codes: can LDCs be made significantly shorter if we allow 
quantum instead of classical encodings? Our main result in this paper is a negative answer to 
this question: essentially it says that (/-query locally decodable quantum codes can be turned into 
(/-query locally decodable classical codes of the same length, with some deterioration in their other 
parameters. The precise statement of this result (Corollaries [9] and [TO]) is a little bit dirty. We 
obtain a cleaner statement for so-called "smooth (quantum) codes" , which have the property that 
they query the codewords fairly uniformly. These smooth (quantum) codes can be converted into 
LD(Q)Cs and vice versa. For these, the precise statement is as follows (Theorem [7]) . 

Suppose we are given a smooth quantum code of m qubits from which we can recover (with 
success probability at least 1/2 + e) each bit X{ of the encoded n-bit string x, while only looking 
at q qubits of the state. Let fi be a distribution on the n-bit inputs. Then we can construct 
a randomized classical code R of the same length (for each x, the "codeword" is a distribution 
over m-bit strings) from which we can recover each Xi with //-average success probability at least 
l/2 + e/4' ?+1 , while only looking at q bits of the codeword. Thus a (/-query quantum code is turned 
into a (/-query classical code of the same length. For those who do not like the idea of encoding x 
into a distribution R(x), we can turn the randomized code R into a deterministic code C, where 
C(x) is a fixed m-bit codeword instead of a distribution, at the expense of correctly decoding only 
a constant fraction of all indices i instead of all n of them (Corollary [8]). 

Since all known lower bounds on LDCs also apply to randomized classical codes that work well 
under a uniform distribution fi on the n-bit strings, those lower bounds immediately carry over to 
LDQCs. In particular we obtain as corollaries of our result: 

• For sufficiently large n, 1-query LDQCs do not exist for any length m (from |KT00 ])l^l 

• z-query LDQCs need length m = 2 e ( n ) (from |KW04j l. 

• For every constant q, (/-query LDQCs need length m = ((n/ log n )i+V(r<j/2"|-i)) (f rom [KW04]). 

Techniques. Our main technique is to apply to the m qubits of the quantum code a randomly 
selected sequence of m Pauli measurements. The randomized "codeword" R(x) will be the probabil- 
ity distribution on m-bit outcomes that results from applying such a measurement to the quantum 
state Q(x). The main part of our proof is to show that there exists a choice of Pauli measurements 
that roughly preserves correct decodability for all indices i. 

2 Actually, this result can more easily be shown directly, by combining Katz and Trevisan's proof for classical codes 
with the quantum random access code lower bound mentioned below in Section [3.41 
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2 Preliminaries 



We write [n] for the set {1, . . . , n}. We use V(S) to denote the set of all probability distributions (or 
random variables) on set S. If z is distributed according to the distribution of a random variable 
Z, we write z ~ Z. We will use this when taking probabilities Pt z ^z or expectations ~R z ~z- 
Probabilities and expectations with a subscript l i G S" should be read as taken over a uniformly 
random i G S. Below we give a brief overview of the concepts of quantum mechanics used here, 
see |NC00l IPre07| for more extensive introductions. 

Quantum states. In quantum mechanics, a physical system is mathematically represented by 
a complex Hilbert space. A d-dimensional complex Hilbert space consists of all (i-dimensional 
vectors with complex entries, endowed with the standard inner product. The state of a physical 
system is in turn represented by a density operator (a positive semidefinite linear operator with 
trace 1) acting on a Hilbert space. We use B+(Hd) to denote the set of all density operators on 
a e?-dimensional complex Hilbert space. States in two-dimensional Hilbert spaces are called qubits. 
Density operators of rank 1 are called pure states. 

Measurements. Information about the state of a physical system can only be obtained by doing 
a measurement. The most general /c-outcome measurement can be defined as a set {A\, . . . , Ak} of 
k positive semidefinite matrices that satisfy Yli=i = I- The probability that the measurement of 
a system in a state p yields the i'th outcome is Tr (Aip). Hence, the measurement yields a random 
variable A(p) with PrLA(/?) = i] = Tr(Aip). With a measurement that has outcomes +1 and — 1 
(and corresponding operators A + and A~) we associate an operator A = A + — A~ . The expected 
value of this measurement on a state p is then Tr(Ap). Note that this equals the difference between 
the probabilities of outcomes +1 and —1, respectively. 

Pauli matrices. The one-qubit Pauli operators are given by 

'=(;;).*=(! ;).r=0-j).»"=(; -?)■ 

For integer k > 1, the set of /c-qubit Pauli operators is Vk := {I, X, Y, Z}® k . These 4 fc matrices form 
an orthonormal basis for the space of all 2 k x 2 k complex matrices endowed with the inner product 
(A,B) = j,tTt(A^ B). Each Pauli operator S G Vk has a unique decomposition 5 = S + — S~, with 
S + and S~ orthogonal projectors that satisfy S + + S~ = I. For this reason we associate a unique 
two-outcome measurement {£ ,+ ,S'~} with each such S. A Pauli measurement S £ Vk of a fc-qubit 
state p yields a ±l-valued random variable S(p) with expected value Tr (Sp). However, we can 
also view S £ Vk as k separate one-qubit Pauli measurements, to be applied to the k qubits of the 
state, respectively. When viewed in this way, the result of measuring p is an /c-bit random variable, 
i.e., a probability distribution on {±l} fc . The product of those k bits equals the ztl-valued random 
variable S(p) mentioned before. 

Super-operators. A super-operator is a mathematical representation of the most general trans- 
formation of a quantum state allowed by the laws of quantum mechanics. A super-operator £ 
can be defined by a finite set {E±, . . . ,Ek} of linear operators (known as Kraus operators) that 
satisfy Yli=i = I- The corresponding operation on a state p yields another density operator, 
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£ (p) = J2i=i EipEj. This £ (p) may act on a Hilbert space of a possibly different dimension, though 
we will not need that here. We say that £ "acts trivially" on, say, the first qubit of the state if all 
its Kraus operators have the form E{ = I ® E[ for some E[ acting on all but the first qubit. 

3 Codes 

It will be convenient to write bits as ±1 instead of 0/1. With this convention, if random variable 
A G {±1} predicts bit Xi 6 {±1}, we can write the bias of this prediction as an expectation: 
E[A ■ Xi ] = Pr[A = x t ] - Pv[A ^ Xi \. Note that Pv[A = Xi ] > 1/2 + e iff E[,4 • Xi ] > 2s. 

3.1 Classical codes 

We start with classical codes. The formal definition of a locally decodable code is as follows. It 
involves a decoder A that receives input i G [n] and oracle access to a string y £ {±l} m , usually 
written as a superscript to A. This y will be a codeword C(x) G {±l} m corrupted by some "error 
string" E £ {±l} m , which negates some of the bits of C{x) (below, C(x)oE denotes the entry-wise 
product of the two m-bit vectors C(x) and E). The oracle "queries index j G [m]" if it reads the 
j'th bit of y. We use A y (i) to denote the ±l-valued random variable that is the algorithm's output. 

Definition 1 (Locally decodable code). A function C : {±l} n — > {±l} m is a (q, 5, e) -locally 
decodable code if there exists a probabilistic oracle algorithm A such that 

1. For every x 6 {±l} n , every i £ [n], and every E G {±l} m with at most 5m —l's, we have 
Pr[A c ^ oE (i) = Xi] > 1/2 + e, where the probability is taken over the internal coin tosses 
of A. 

2. A queries at most q indices of y. Queries are made non-adaptively, meaning that the indices 
to be queried are all selected before the querying starts. 

An algorithm A satisfying the above is called a (q, 5, e) -local decoder for C. 

Since any 5m indices can be corrupted, a local decoder must query the indices fairly uniformly. 
Otherwise, an adversary could choose to corrupt the most queried part of the code and ruin the 
decoder's success probability. Motivated by this property, Katz and Trevisan [KT00| defined a 
variation of a locally decodable code called a smooth code, defined only for uncorrupted codewords. 

Definition 2 (Smooth code). A function C : {±l} n — > {±l} m is a (q, c, e) -smooth code if there 
exists a probabilistic oracle algorithm A such that: 

1. For every x £ {±l} n and i G [n], we have Pr^^^'^i) = Xj\ > 1/2 + e. 

2. For every i G [n] and j G [m], we have Pi[A^'\i) queries index j] < c/m. 

3. A queries at most q indices (non-adaptively). 

An algorithm satisfying the above is called a (q,c,e)- smooth decoder for C. 

Katz and Trevisan showed that LDCs and smooth codes are essentially equivalent, in the sense 
that a decoder for one can be transformed into a decoder for the other. We will prove the same for 
quantum codes in Section 13.31 using essentially their proof. 
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3.2 Randomized codes 

Here we define our first generalization, incorporating randomness into the definition of the code. A 
randomized locally decodable code (randomized LDC) maps {±l} n to random variables over {±l} m 
(rather than fixed codewords), such that any x\ can be decoded well using a constant number of 
queries, even if up to 5m indices are corrupted. The formal definition is as follows. 

Definition 3 (Randomized locally decodable code). A function R : {±l} n — > V({±l} m ) is a 
(q, c, e)-randomized locally decodable code if there exists a probabilistic oracle algorithm A such 
that: 

1. For every x £ {±1}™, every i £ [n], and every E £ {±l} m with at most 5m —l's, we have 
Pr[A R ^ oE (i) = Xi]] > 1/2 + e, where the probability is taken over the internal coin tosses 
of A as well as the distribution R(x). 

2. A queries at most q indices (non-adaptively) . 

An algorithm A satisfying the above is called a (q, 5, e) -randomized local decoder for R. 

Similarly, we define a randomized smooth code: 

Definition 4 (Randomized smooth code). A function R : {±1}™ — > V({±l} m ) is a (q,c,e)- 
randomized smooth code if there exists a probabilistic oracle algorithm A such that: 

1. For every x £ {±l} n and every i € [n], we have Pi[A R ^ x \i) = Xj\ > 1/2 + e. 

2. For every i £ [n], and every j £ [to], we have Pr[^4^')(i) queries index j] < c/m. 

3. A queries at most q indices (non-adaptively) . 

An algorithm A satisfying the above is called a (q,c,e) -randomized smooth decoder for R. 

It will be convenient to also have a version of these codes that are only required to work well 
on average, instead of for all x: 

Definition 5 (/i-average codes). Let n be a distribution on {±l} n . A function C : {±l} n — > {±l} m 
is a /i-average (q, 5, e)-locally decodable code if Definition^ holds with the first clause replaced by: 

1. For every i £ [n] and E £ {±l} m with at most 5m —1 's, Pi x ^ fl [A c ^ oE (i) = Xj] > \ + e - 

Analogously, we define /x- average versions of smooth codes, randomized LDCs, and randomized 
smooth codes. For these codes, we assume without loss of generality that for each i and queried set 
r C [to], the decoder A always uses the same function f{ T : {±1} 9 — > {±1} to determine its output. 

A /^-average randomized smooth code can actually be "derandomized" to a //-average smooth 
code on a smaller number of bits: 

Lemma 1. Let R : {±l} n — > V({±l} m ) be a \i-average (q,c,e) -randomized smooth code. Then 
there exists a ^-average (q, c, e/2)-smooth code C : {±l} n — ► {±l} m for at least en of the indices i 
(that is, a smooth code with fi-success probability at least 1/2 + e/2 for at least en of the n indices). 
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Proof: As a first step we will view R as a function to strings: there exists a random variable Z 
(over some possibly infinite set Z) and a function R : {±1}™ x Z — > {±l} m such that for every 
x G {±l} ra , the random variables R(x, Z) and are the same. A decoder A for R also works 

for R(-, Z), so we have bias E x ~ix,z~z[A R ( x,z \i) ■ xi\ > 2e for every i G [n]. For every i G [n] and 
z £ Z, define variables X^ z G {0, 1}, with 



1 



E 



L [A R ^ z \i) ■ x t \ >e, 

and Xj. := Y17=i X,z- Using the definition of a p-average randomized smooth code, we have 

n 

2en < ^^ z [^)(t 



i=i 



i=i 



< E^ z [^ + (n-X z )e] 
= en+(l-e)E z „ z [X z ]. 

Hence E zr ^z[X z ] > en. Thus there exists & z £ Z such that for at least en of the n indices i, we 



have E x „u,[A R ( x 



> e, equivalently, K x ^[Pr[A R ^ z \i) = Xi]] > 1/2 + e/2. Defining the 



code C(-) := R(-,z) gives the lemma. 



3.3 Quantum codes 

Our second level of generalization brings quantum mechanics into the picture: now our code maps 
classical n-bit strings to m-qubit quantum states. Decoding of these codes requires algorithms that 
use both quantum measurements and properties of classical probabilistic oracle algorithms. Below, 
with "quantum oracle algorithm" we mean an algorithm A with oracle access to an m-qubit state p, 
which is written as a superscript. This p could be a corrupted version of an m-qubit "codeword" 
Q(x), obtained by applying some super-operator £ to Q(x). This £ should only affect a (5-fraction 
of the m qubits. This way of modelling the error generalizes the classical case: a classical error 
pattern E £ {±l} m corresponds to a super-operator £ that applies an X to the qubits at positions 
where E has a —1, and I to the positions where E has a +1. On input i G [n], the algorithm 
probabilistically selects a set r C [m] of at most q indices of qubits of this state, and applies a 
two-outcome measurement to the selected qubits with operators and Aj . As before, we will 
use il A p (i)" to denote the ±l-valued random variable that is the output. We say that ll A queries 
r", and 11 A queries index j" if j is in r. Note that such algorithms are non-adaptive by definition: 
they first select the qubits in r, and then apply one measurement to those qubits. 
We now define a locally decodable quantum code (LDQC) as follows: 

Definition 6 (Locally decodable quantum code). A function Q : {±l} n — > B] r (H2 m ) is a (q,5,e)- 
locally decodable quantum code if there exists a quantum oracle algorithm A such that: 

1. For every x G {±l} n , every i G [n], and every super- operator £ that acts non-trivially on at 
most dm qubits, we have ~Pt[A £ ^^ x ^ (i) = Xi] > 1/2 + e, where the probability is taken over 
the coin tosses and measurements in A. 

2. A queries at most q indices (non- adoptively) . 
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An algorithm A satisfying the above requirements is called a (q,5,e)-local quantum decoder for Q. 

LDQCs generalize randomized LDCs, because probability distributions are just diagonal density 
operators. Similarly, we can establish a smoothness property also for quantum codes: 

Definition 7 (Smooth quantum code). A function Q : {±l} n — > £>^_(7^2 m ) is o, (q, c, e) -smooth 
quantum code if there exists a quantum oracle algorithm A such that: 

1. For every x € {±l} n and every i G [n], we have Pi[A®( x \i) = Xj\ > 1/2 + £. 

2. For every i 6 [n] and every j G [m], we have Pi[A^'(i) queries index j ] < c/m. 

3. A queries at most q indices (non-adaptively) . 

An algorithm A satisfying the above is called a (q,c,e) -smooth quantum decoder for Q. 

As Katz and Trevisan [KTOO] did for classical LDCs, we can establish a strong connection 
between LDQCs and smooth quantum codes. Either one can be used as the other, as the next 
theorems show. Analogues of these theorems also hold between randomized LDCs and randomized 
smooth codes, and between the /i-average versions of these codes. 

Theorem 2. Let Q : {±1}™ — > B\{li.2 m ) be a (q,c,e)- smooth quantum code. Then, as long as 
5 < s/c, we have that Q is also a (q,5,e — 6c) -locally decodable quantum code. 

Proof: Let A be a (g, c, e)-smooth quantum decoder for Q. Suppose we run it on £(Q(x)) with 
at most 5m corrupted qubits. The probability that A queries a specific qubit is at most c/m. 
Then by the union bound, the probability that A queries any of the corrupted qubits is at most 
5mc/m = 5c. Hence A itself is also a (q, 5, e — <5c)-local quantum decoder for Q. ■ 

Theorem 3. Let Q : {±l} n — > B\{7i2^) be a (q, 5, e) -locally decodable quantum code. Then Q is 
also a (q,q/5,e)-smooth quantum code. 

Proof: Let A be a (q, 5, e)-local quantum decoder for Q. For each i € [n] , let Pi(j) be the probability 
that on input i, A queries qubit j. Let Hi = {j \ Pi(j) > q/{5m)}. Then \H,i\ < 5m, because A 
queries no more than q indices. Let B be the quantum decoder that simulates A, except that 
on input i it does not query qubits in Hi, but instead acts as if those qubits are in a completely 
mixed state. Then B does not measure any qubit j with probability greater than q/(5m). Also, £>'s 
behavior on input i and Q{x) is the same as ^4's behavior on input i and £(Q(x)) that is obtained 
by replacing all qubits in Hi by completely mixed states. Since £ acts non-trivially on at most 
\Hi\ < 5m qubits, we have Vx[B Q{ - x \i) = x-} = Pr[A £{Q{x)) (i) = a*] > 1/2 + e. ■ 

3.4 A weak lower bound from random access codes 

We can immediately establish a weak lower bound on the length of LDQCs and smooth quantum 
codes by considering a quantum random access code (QRAC) [ANTV02], which generalizes both. 

Definition 8 (Quantum random access code). A function Q : {±l} n — > B] t iTi2 m ) is an (n,m,e)- 
quantum random access code if there exists a quantum oracle algorithm A such that for every 
x G {il} n and i 6 [n], Pr[AP^ x \i) = xi\ > 1/2 + e. An algorithm A that satisfies this is called a 
quantum random access decoder for Q . 
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LDQCs and smooth quantum codes are QRACs with some additional properties, such as con- 
straints on the way the qubits of the codeword are accessed. Hence the following well-known lower 
bound on the length of QRACs also holds for them. 

Theorem 4 (ANTV [ANTV021 [Nay99] ) . Every (n,m,e)-QRAC satisfies m > (1 - i?(l/2 + e))n. 



4 Pauli decoding from disjoint subsets 

In this section we consider a (q, c, e)-smooth quantum code Q. Fix a distribution ^ on {±l} n . We 
will show that there exists a sequence S* G V m such that if the m qubits of Q(x) are measured 
by the m Pauli measurements in S* , then each Xi can be retrieved by querying only q bits of the 
m-bit measurement outcome S*(Q(x)), in a very structured way. Specifically, we prove: 

Theorem 5. Let Q : {±l} n — > B\(7i2 m ) be a (q,c,e)-smooth quantum code and fi be a distribution 
on {±l} n . Then there exists a sequence S* G V m , and for every i G [n] a set Mi of at least em/ (qc) 
disjoint sets r C [to] (each of size at most q) with associated signs aj >r G {±1}, such that 



E, 



I Mi 



^Pr[a 4 , r n^(Q(x)) 



Xi 



re Mi 



1 | e 
- 2 + 49+1' 



The proof consists of two parts. We start by constructing the sets Mi and then we show that 
decoding Q can be done by using only Pauli measurements. Putting these two observations together 
enables us to prove Theorem [5j 

As an aside, the fact that this theorem works for every distribution fi allows us to turn smooth 
codes into schemes for private information retrieval (PIR) that work for every x G {±l} n instead 
of only on average. We explain this in Appendix [Al 



4.1 Decoding from disjoint subsets 

First we construct the large sets Mj of disjoint g-sets that enable reasonably good prediction of x^. 

Theorem 6 (modified from Lemma 4 in [KTOOj). Let Q : {±1}™ — > B+(li.2 m ) be a (q,c,e) -smooth 
quantum code with decoder A, and \x a distribution on {±1}™. Then for every i € [n] there exists 
a set Mi of at least em/(qc) disjoint sets r C [m] (each of size at most q) satisfying 

PT x ^^[A Q( - x) (i) = Xi | A^(i) queries r] > ^ + |. 

Proof: Call a set r C [m] "good for i" if it satisfies the inequality stated in the theorem. Define 
for every i G [n] a hypergraph Hi = (V, Ei) with vertex-set V = [m] and a set of hyperedges 
Ei := {e | e is good for i}. Say that a smooth quantum decoder A for Q "queries E" if A queries 
an e G E { . Let p(e) := Pr[^4.W(i) queries e\. Then the probability that this decoder queries Ei is 
p(Ei) := J2eeEiP( e )- F° r an e ^ Ei we have 

Y>r[A Q{x \i) = Xi \ A { '\i) queries e] < ^ + |. 
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But since for every x and i, A decodes bit Xj with probability at least 1/2 + e, we have 

~ + e < Pr[^OW(i) = Xi\ < p(E { ) + (1 -p(^))(i + £) = i + | + - |). 

Hence p(E{) > e/(l — e) > e. Since Q is a smooth quantum code, we know that the probability 
that A queries an index j is YleeEAje.eP( e ) = P r [*4 (*) queries j\ < c/m. 

Let Mi be a maximal set of disjoint hyperedges in Hi, and define the vertex set T = U eg M;e. 
Note that T has at most q\Mi\ elements and that it intersects each e G E 1 , (since otherwise |Mj| 
would not be maximal). We can now lower bound the size of Mj as follows: 

, i x -« . . (*) x— v \ -> / s c\T\ cq\Mi\ 

t ^ 'Tin 'Tin 

where (*) holds because each e G Ei is counted exactly once on the left hand side, and at least once 
on the right-hand side (since T intersects each e G £7j). Hence \M{\ > em/(qc). ■ 



4.2 Pauli decoding 

In the second part of the proof of Theorem [5j we find the appropriate Pauli measurements. Recall 
that to decode Xj, a smooth quantum decoder first selects a set r C [m] of at most g indices, and then 
applies some measurement with operators Af r , A~ r to determine its output. Let Ai <r = Af r — A^ r . 
Strictly speaking these operators act only on the qubits indexed by r, but we can view them as 
acting on the m-qubit state Q(x) by tensoring them with m — \r \ identities. The difference between 
the probabilities of obtaining outcomes +1 and —1 is Tr(^4j ir • Q{x)). For every i G [n] and r € Mj 
we define the following bias: 

B(i,r) :=E x ^[Tr(A hr -Q(x))-Xi]. 

This measures how well the measurement outcome is correlated with X{ (with x weighted according 
to fi). From Theorem [6] we have B(i,r) > e for every i € [n] and every r G Mj. 
Since V q is a basis for all 2 q x 2 q complex matrices we can write 

sev q 

with A^r(S) := {A i>r , S) = ^Tr(A i>r • S) G [-1, 1]. We now have: 

e < B(i,r) = E A~; r (S)E x ^[Tr(S ■ Q{x)) ■ Xi ] < E K^[Tr(S • Q(x)) ■ Xi ]\ . (1) 
sev q sev q 

Suppose we measure the r-qubits of Q(x) with some 5 G V q and get outcome b G {±1}- The 
quantity K Xr ^^[Tr(S • Q(x)) ■ xi\ is the difference between Pr a .^ t [6 = Xj\ and Vv x ^,^\b ^ Xj\. If we 
output b if this difference is nonnegative, and —b otherwise, then we would predict Xi with bias 

B'(i,S,r) := \E x ^[Tr{S ■ Q(x)) ■ Xi}\ . 

From Equation (p} we know that this bias is at least e/4 9 for at least one "good" S G V q . Hence, 
with some loss in success probability, we can decode Q by only using Pauli measurements. We now 
use a probabilistic argument to prove that a good sequence S* of Pauli measurements exists, which 
is simultaneously good, for every i G [n], for most of the elements r G M{. 
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Proof (of Theorem [5]): Suppose we let S £ V q be a random variable uniformly distributed over 
V q , and we use it to predict Xi as above. Then B'(i, S, r) is a random variable in the interval [0, 1], 
with expectation 



E SeVq [B'(i,S,r)} = ± J2 \^[Tr(S ■ Q(x)) ■ Xi ] \ > 



sev„ 



e 

4«' 



Now we consider m-qubit Pauli measurements and replace all elements not in r with J's: for S £ V m 
and r C [m], let denote S with all its m — \r\ elements outside of r replaced by I. If we let S be 
uniform over V m , we get biases B'(i, S( r ), r) for each r £ Mj, each in [0, 1] and with expectation at 
least e/4 q (over the choice of SV r )). But note that the random variables -B'(i, S( r ), r) are independent 
from each other for different r £ Mj, since the elements of Mj are disjoint. Hence the average bias 
over all r £ Mj, 



is the average of |Mj| independent random variables, each in [0,1] and with expectation at least 
e/4 9 . By a Chernoff bounqj the probability that B'(S,i) is much smaller than its expectation, is 



small: 



Pi s 



B'(S,i) < 



1 e 
249 



B'(S,i) < -E[B'(S,i)} 



< 



cxp 



\Mj\e 
8-41 



By Theorems 0] and [6] we may assume |Mj| > 4 9 log(n)/e. It follows that the above probability is 
less than 1/n. Since this is true for every index i£ [n], the union bound gives 



3i s.t. B'(S,i) < 



1 e 
24? 



< 



B'(S,i) < 



1 e 
249 



< 1. 



We can thus conclude that there exists an S* € V m such that for every i G [n] we have 



1 E_ 

249' 



This implies the statement of the theorem. 



5 Classical codes from quantum codes 

Theorem [5] implies that if we measure all m indices of a smooth quantum quantum code Q with 
the elements of S*, then we get distributions on {±l} m that can be massaged to "codewords" R(x) 
of a randomized smooth code: 

Theorem 7. Let Q : {±l} n — ► B^(H.2 m ) be a (q,c,e)- smooth quantum code. Then for every 
input distribution [i on {±l} n , there exists a fi-average (q, qc/e, e/49 +1 ) -randomized smooth code 
R : {±l} n -> V({±l} m ). 

3 See Equation (7) in [HR 90 . A small modification of their proof shows that this bound not only holds for 
independent 0/1- variables, but also for independent variables in the interval [0, 1]. 
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Proof: We use Theorem [5j Let R{x) be the distribution on {±l} m obtained by measuring Q(x) 
with S*. We define a decoder A for R as follows: on input i € [m] and oracle y € {±l} m , pick a 
set r from the set Mj uniformly at random, and return CLi^YY-^yj. It is straightforward to check 
that A is a ^-average (q, qc/e, e/4 q+1 ) decoder for R; in particular, since A picks r uniformly from 
a set of at least £m/(qc) disjoint sets, each index j € [m] has probability at most qc/(em) of being 
queried. ■ 

Combining Lemma [T] and Theorem [71 we immediately get the following "derandomization" : 

Corollary 8. Let Q : {±l} n — > B\(^H.2 m ) be a (q,c,e)- smooth quantum code. Then for every 
distribution fj, on {±1}", there exists a C : {±1}™ — > {±l} m which is a ^-average {q,qc/e,e/{2 ■ 
4 <?+1 )) -smooth code for at least en/^ q+l of the n indices. 

Following the path through Theorems El [7J and the ^-average version of Theorem [2j we can 
turn an LDQC into a /^-average randomized LDC: 

Corollary 9. Let Q : {±l} n — > B^_(Ti.2^) be a (q, 5, e) -locally decodable quantum code. Then, 
as long as 6' < 5e 2 /(g 2 4 9+1 ) ; for every distribution \i over {±l} n , there exists an R : {±l} n — > 
■p({±l} m ) which is a ^-average (q, 5', e/4 9+1 — 5' q 2 / (Se)) -randomized locally decodable code. 

Going through Theorem El Corollary El and the ^-average version of Theorem [2] instead, we 
can also turn an LDQC into a /U-average LDC: 

Corollary 10. Let Q : {±l} n — > B\{Ti2^) be a (q, 5, e) -locally decodable quantum code. Then, as 
long as 5' < 5e 2 / (2q 2 A q+l ) , for every distribution fi over {±l} n , there exists a C : {±l} n — > {±l} m 
which is a ^-average (q, 5' , ej (2 • 4 9+1 ) — S'q 2 / (5s))-locally decodable code for at least en/4 9+1 of the 
n indices. 

6 Conclusion and open problems 

We defined quantum generalizations of (/-query locally decodable codes in which q queries cor- 
respond to a measurement on q qubits of the m-qubit codeword. By a reduction to (classical) 
randomized smooth codes through a special sequence of Pauli measurements on an LDQC, we 
showed that the use of quantum systems for this type of encoding can not provide much advantage 
in terms of length, at least for small q. An obvious open problem is reducing the gap between 
upper and lower bound on the length m of LDCs for fixed small number of queries q. Our results 
show that an upper bound for LDQCs would carry over to (/U-average) LDCs. This might perhaps 
be a way to improve the best known classical upper bounds on m. 
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A PIR schemes from LDCs 



Katz and Trevisan [KTOOj showed that LDCs are closely related to so-called private information 
retrieval (PIR) schemes, first introduced by Chor et al. [CGKS98]. In a PIR scheme, q non- 
communicating "servers" each hold a copy of the same database x G {±l} n . A "user" interacts 
(usually in only one round of communication) with these servers to retrieve the i'th bit x% while 
preserving privacy: individually, the servers should get no information whatsoever about which 
index i the user is interested in. The resource to be minimized is the amount of communication 
between user and servers. 

Katz and Trevisan observed that a smooth code implies a PIR scheme where the user has good 
recovery probability on average. Specifically, Theorem [6] gives a (q, q, e 2 /(2c))-smooth decoder as 
follows. We complete the set Mj to a set M[ of exactly m/q disjoint g-tuples (assume for simplicity 
that q divides m). Now the decoder uniformly picks an r € M[ and queries those q indices. If r 
contains an element of (which happens with probability at least e/c) then the decoder proceeds 
as before, predicting Xi with probability at least l/2+e/2 (under otherwise the decoder outputs 
a fair coin flip. Note that for each i G [n], the overall success probability (under //) is at least 
(e/c)(l/2 + e/2) + (1 — e/c)/2 = l/2 + e 2 /(2c). Also, each index j G [m] is queried with probability 
exactly q/m. Thus we have a /(/-average (q, q, e 2 /(2c))-smooth code. 

This in turn gives a PIR scheme with good success probability under \x: the user just sends one 
query to each of the servers, the servers return the requested bit of the code, and the user gives 
the same output as the code's decoder. Since each query individually is uniformly distributed, no 
information about i will be leaked to individual servers O 

However, we can actually show that there exists a (q, q, e 2 / (2c))-smooth decoder that can decode 
any bit Xi for every x G {±l} n , hence giving true PIR schemes that work for every database instead 
of only on //-average. 

Theorem 11. Let C : {±l} n — > {±l} m be a (q, c, e)-smooth code. Then there exists a (q, q, e 2 / (2c) )- 
smooth decoder for C . 

Proof: Fix an i G [n]. We will show that there exists a decoder B(i) such that for all x G {±l} n 

Pr[B Cf W(i)=x i ]>i + ^. 

Consider all possible pairs (M,F), where M is a set of at least em/(qc) disjoint sets r C [m], each 
of size at most q, and F contains one Boolean function f r for each r £ M. Define a decoder A^m,f) 
that decodes according to this pair, i.e., it queries a uniformly random r G M and applies f r G F 
to the results. Define a matrix P, with rows indexed by all x and columns by pairs (M,F): 

Px,{M,F) = Pr [-^(M^F) = x i\- 

Theorem [6] says that for every distribution fi over {±l} n , there exists a column of P (i.e., an (M, F) 
pair) with [i- aver age at least 1/2 + e/2. 

For each x define 2 n -dimensional 0/1-vector e x with a 1 only at position x, and similarly define 
0/1-vector u^^py For probability distributions \i (on the set of all x) and u (on the set of all pairs 

4 The same argument works to derive PIR schemes from codes over a non- binary alphabet, where the servers' 
answers are more than one bit. Conversely, one can get a smooth code from a one-round PIR scheme by, roughly 
speaking, concatenating all answers of the q servers to all possible messages that the user can send them. 
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(M,F)), define vectors e M = ^xg{±i)" n( x ) e x and u v = Y,(M,F) v ((M,F))u( MjF y Then Yao's 
principle (i.e., the minimax theorem as used in |Yao77] ) gives us 

1 S HP HP 

— I — < min max e„Pu(M pi = maxmin e T P«i/. 

2 2 ~ M (M,F) M 1 ' ' v x x 

Let ^ be a distribution that maximizes the right-hand side. Let B(i) select a pair (M, F) according 
to distribution u, complete M to some M' , and use a uniformly chosen element of M[ to predict x«, 
as explained before the theorem. Then B(i) queries every index with probability exactly q/m, and 
satisfies 

1 F 2 

min Pr[B C{x) (i) = xA > - + — . 
x£{±i} n 2 2c 

Hence the algorithms £>(1), . . . , S(n) form a (q, g, e 2 / (2c))-smooth decoder for C. ■ 
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